File name:

2025-06-26_3bfc874b96d701bdcc60998028b3c957_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer

Full analysis: https://app.any.run/tasks/f97be40d-e3a4-4d04-ab1e-e7e0a093adcf
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: June 26, 2025, 19:59:53
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
amadey
botnet
stealer
lumma
rdp
themida
jphploader
auto-reg
qrcode
arch-scr
lclipper
clipper
evasion
arch-doc
telegram
gcleaner
auto
generic
stealc
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

3BFC874B96D701BDCC60998028B3C957

SHA1:

11AF9CD9660F0B3E756B00A485FC3AFDCC4B301F

SHA256:

5D8F0C350AC2C4EB4E695B137D3479FDAA4C91DF4EB4FEBCED5E636892161E6D

SSDEEP:

49152:HPPkzemqoSut3Jh4+QQ/btosJwIA4hHmZlKH2Tw/Pq83zw0bCjvk9G661QGtQNXS:vP/mp7t3T4+B/btosJwIA4hHmZlKH2Tm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 6420)
      • cmd.exe (PID: 7204)
      • cmd.exe (PID: 7820)
      • cmd.exe (PID: 7236)
      • cmd.exe (PID: 7516)
    • AMADEY mutex has been found

      • RoamingTUAGRCHJFIDLJMJ5Z6RPUHIYL0CD4I4P.EXE (PID: 1156)
      • dumer.exe (PID: 5444)
      • dumer.exe (PID: 5424)
      • bSFmlcIa.exe (PID: 7188)
      • bSFmlcIa.exe (PID: 4104)
      • RoamingWW8HEHXFUNMHLXYZUTYN4XSXXMBEZWAQ.EXE (PID: 8028)
      • RoamingGXN1RKXVBZRDCUB4AJWIMTQSP7XSSUIG.EXE (PID: 8060)
      • dumer.exe (PID: 8304)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 4932)
      • powershell.exe (PID: 8068)
      • powershell.exe (PID: 8052)
    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 4932)
      • powershell.exe (PID: 8068)
      • powershell.exe (PID: 8052)
    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 4932)
      • powershell.exe (PID: 8068)
      • powershell.exe (PID: 8052)
    • AMADEY has been detected (SURICATA)

      • dumer.exe (PID: 5444)
    • Connects to the CnC server

      • dumer.exe (PID: 5444)
      • svchost.exe (PID: 2200)
      • explorer.exe (PID: 1336)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2200)
      • A7KX0pa.exe (PID: 2708)
      • dbd2803170.exe (PID: 5652)
      • dbd2803170.exe (PID: 5824)
    • AMADEY has been detected (YARA)

      • dumer.exe (PID: 5444)
    • LUMMA mutex has been found

      • A7KX0pa.exe (PID: 2708)
      • dbd2803170.exe (PID: 5652)
      • dbd2803170.exe (PID: 5824)
    • LUMMA has been detected (YARA)

      • A7KX0pa.exe (PID: 2708)
    • Steals credentials from Web Browsers

      • A7KX0pa.exe (PID: 2708)
      • explorer.exe (PID: 1336)
    • Actions looks like stealing of personal data

      • A7KX0pa.exe (PID: 2708)
      • explorer.exe (PID: 1336)
    • JPHPLOADER has been detected

      • new-installer.exe (PID: 5424)
    • Changes the autorun value in the registry

      • dumer.exe (PID: 5444)
      • sFFG7Wg.exe (PID: 1136)
    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 7812)
      • NSudoLG.exe (PID: 7392)
    • Changes Windows Defender settings

      • NSudoLG.exe (PID: 7392)
    • Executing a file with an untrusted certificate

      • d09db9f5c6.exe (PID: 8184)
      • ac75769993.exe (PID: 7760)
      • svchost015.exe (PID: 1612)
      • SynapseR86.exe (PID: 3864)
      • rM14ix6.exe (PID: 3396)
      • XPFix.exe (PID: 9064)
    • Application was injected by another process

      • control.exe (PID: 1612)
      • control.exe (PID: 6428)
    • Runs injected code in another process

      • oSOnryg.exe (PID: 4552)
    • GENERIC has been found (auto)

      • dumer.exe (PID: 5444)
      • Tu_Inspector32.exe (PID: 7020)
    • LCLIPPER mutex has been found

      • sFFG7Wg.exe (PID: 1136)
      • GoogleChrome.exe (PID: 4112)
      • GoogleChrome.exe (PID: 6980)
    • ARKEISTEALER has been found (auto)

      • dumer.exe (PID: 5444)
    • GCLEANER has been detected (SURICATA)

      • svchost015.exe (PID: 1612)
    • STEALC has been detected

      • Fv6kVbJ.exe (PID: 8860)
  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • 2025-06-26_3bfc874b96d701bdcc60998028b3c957_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 2040)
      • LWlH14qk.exe (PID: 2324)
      • 0370oKis.exe (PID: 7196)
      • nircmd.exe (PID: 7508)
      • NSudoLG.exe (PID: 7752)
      • cmd.exe (PID: 7812)
      • b2d794c6e7.exe (PID: 7732)
      • LWlH14qk.exe (PID: 8016)
      • 0370oKis.exe (PID: 640)
      • b2d794c6e7.exe (PID: 7524)
      • Unlocker.exe (PID: 7344)
      • Unlocker.exe (PID: 7588)
      • Unlocker.exe (PID: 7288)
      • Unlocker.exe (PID: 7660)
      • Unlocker.exe (PID: 8120)
      • Unlocker.exe (PID: 7696)
      • sFFG7Wg.exe (PID: 1136)
      • cmd.exe (PID: 6320)
    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 3520)
      • NSudoLG.exe (PID: 7392)
      • mshta.exe (PID: 7660)
      • mshta.exe (PID: 7384)
      • openfilesviewer.exe (PID: 8708)
    • Found IP address in command line

      • powershell.exe (PID: 4932)
      • powershell.exe (PID: 8068)
      • powershell.exe (PID: 8052)
    • Manipulates environment variables

      • powershell.exe (PID: 4932)
      • powershell.exe (PID: 8068)
      • powershell.exe (PID: 8052)
    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 4932)
      • dumer.exe (PID: 5444)
      • powershell.exe (PID: 8052)
      • explorer.exe (PID: 1336)
      • svchost015.exe (PID: 1612)
    • Starts process via Powershell

      • powershell.exe (PID: 4932)
      • powershell.exe (PID: 8068)
      • powershell.exe (PID: 8052)
    • Probably download files using WebClient

      • mshta.exe (PID: 3520)
      • mshta.exe (PID: 7660)
      • mshta.exe (PID: 7384)
    • Process requests binary or script from the Internet

      • powershell.exe (PID: 4932)
      • dumer.exe (PID: 5444)
      • powershell.exe (PID: 8068)
      • powershell.exe (PID: 8052)
    • Connects to the server without a host name

      • powershell.exe (PID: 4932)
      • dumer.exe (PID: 5444)
      • powershell.exe (PID: 8068)
      • powershell.exe (PID: 8052)
      • control.exe (PID: 6428)
      • svchost015.exe (PID: 1612)
      • Fv6kVbJ.exe (PID: 8860)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 4932)
      • RoamingTUAGRCHJFIDLJMJ5Z6RPUHIYL0CD4I4P.EXE (PID: 1156)
      • dumer.exe (PID: 5444)
      • javaw.exe (PID: 7108)
      • index.exe (PID: 3980)
      • extrimloader.exe (PID: 6140)
      • 8Ro1yoh0.exe (PID: 3980)
      • 0370oKis.exe (PID: 7196)
      • 8Ro1yoh0.exe (PID: 7172)
      • powershell.exe (PID: 8068)
      • 7z.exe (PID: 7340)
      • Unlocker.exe (PID: 7588)
      • powershell.exe (PID: 8052)
      • Unlocker.exe (PID: 7288)
      • Unlocker.exe (PID: 7660)
      • Unlocker.exe (PID: 8120)
      • Unlocker.exe (PID: 7696)
      • tktVLbc.exe (PID: 3860)
      • Tu_Inspector32.exe (PID: 4232)
      • tktVLbc.tmp (PID: 7824)
      • Tu_Inspector32.exe (PID: 7020)
      • ac75769993.exe (PID: 7760)
      • sFFG7Wg.exe (PID: 1136)
      • SynapseR86.exe (PID: 3864)
      • explorer.exe (PID: 1336)
      • svchost015.exe (PID: 1612)
      • Dg77GEr8dU.exe (PID: 8836)
      • Dg77GEr8dU.tmp (PID: 7852)
      • openfilesviewer.exe (PID: 8708)
    • Reads security settings of Internet Explorer

      • dumer.exe (PID: 5444)
      • RoamingTUAGRCHJFIDLJMJ5Z6RPUHIYL0CD4I4P.EXE (PID: 1156)
      • extrimloader.exe (PID: 6140)
      • index.exe (PID: 3980)
      • 0370oKis.exe (PID: 7196)
      • nircmd.exe (PID: 7508)
      • index.exe (PID: 7604)
      • 0370oKis.exe (PID: 640)
      • Unlocker.exe (PID: 7344)
      • Unlocker.exe (PID: 7588)
      • Unlocker.exe (PID: 7288)
      • Unlocker.exe (PID: 7660)
      • Unlocker.exe (PID: 8120)
      • Unlocker.exe (PID: 7696)
      • sFFG7Wg.exe (PID: 1136)
      • svchost015.exe (PID: 1612)
      • GoogleChrome.exe (PID: 4112)
      • GoogleChrome.exe (PID: 6980)
      • Fv6kVbJ.exe (PID: 8860)
      • openfilesviewer.exe (PID: 8708)
    • Contacting a server suspected of hosting an CnC

      • dumer.exe (PID: 5444)
      • svchost.exe (PID: 2200)
      • A7KX0pa.exe (PID: 2708)
      • dbd2803170.exe (PID: 5652)
      • dbd2803170.exe (PID: 5824)
      • explorer.exe (PID: 1336)
    • Starts itself from another location

      • RoamingTUAGRCHJFIDLJMJ5Z6RPUHIYL0CD4I4P.EXE (PID: 1156)
      • Tu_Inspector32.exe (PID: 4232)
    • Reads the BIOS version

      • A7KX0pa.exe (PID: 2708)
      • dbd2803170.exe (PID: 5652)
      • dbd2803170.exe (PID: 5824)
      • Oz63bRwcl7f1P.exe (PID: 7964)
    • There is functionality for enable RDP (YARA)

      • dumer.exe (PID: 5444)
    • There is functionality for taking screenshot (YARA)

      • dumer.exe (PID: 5444)
      • javaw.exe (PID: 4816)
    • Checks for Java to be installed

      • launcher.exe (PID: 4084)
    • The process executes via Task Scheduler

      • dumer.exe (PID: 5424)
      • dumer.exe (PID: 8304)
    • Reads the date of Windows installation

      • extrimloader.exe (PID: 6140)
      • nircmd.exe (PID: 7508)
      • Unlocker.exe (PID: 7344)
      • Unlocker.exe (PID: 7588)
      • Unlocker.exe (PID: 7288)
      • Unlocker.exe (PID: 7660)
      • Unlocker.exe (PID: 8120)
      • Unlocker.exe (PID: 7696)
    • The process drops C-runtime libraries

      • extrimloader.exe (PID: 6140)
      • Tu_Inspector32.exe (PID: 4232)
      • tktVLbc.tmp (PID: 7824)
      • Dg77GEr8dU.tmp (PID: 7852)
    • Drops 7-zip archiver for unpacking

      • index.exe (PID: 3980)
      • 0370oKis.exe (PID: 7196)
    • Process drops legitimate windows executable

      • extrimloader.exe (PID: 6140)
      • dumer.exe (PID: 5444)
      • tktVLbc.tmp (PID: 7824)
      • Tu_Inspector32.exe (PID: 4232)
      • Dg77GEr8dU.tmp (PID: 7852)
    • The executable file from the user directory is run by the CMD process

      • nircmd.exe (PID: 7432)
      • nircmd.exe (PID: 7508)
      • nircmd.exe (PID: 7668)
      • nircmd.exe (PID: 7888)
      • NSudoLG.exe (PID: 7752)
      • NSudoLG.exe (PID: 7392)
      • nircmd.exe (PID: 7380)
      • 7z.exe (PID: 7340)
      • Unlocker.exe (PID: 7344)
      • Unlocker.exe (PID: 7588)
      • Unlocker.exe (PID: 7288)
      • Unlocker.exe (PID: 7660)
      • Unlocker.exe (PID: 8120)
      • Unlocker.exe (PID: 7696)
      • GoogleChrome.exe (PID: 4112)
    • Executing commands from a ".bat" file

      • 0370oKis.exe (PID: 7196)
      • nircmd.exe (PID: 7508)
      • NSudoLG.exe (PID: 7752)
      • 0370oKis.exe (PID: 640)
    • Starts application with an unusual extension

      • cmd.exe (PID: 7356)
      • cmd.exe (PID: 7600)
      • cmd.exe (PID: 7812)
    • The process creates files with name similar to system file names

      • 0370oKis.exe (PID: 7196)
    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7600)
      • cmd.exe (PID: 7812)
    • Application launched itself

      • cmd.exe (PID: 7812)
      • control.exe (PID: 1612)
      • cmd.exe (PID: 6320)
      • Fv6kVbJ.exe (PID: 8692)
    • Get information on the list of running processes

      • cmd.exe (PID: 7812)
      • cmd.exe (PID: 8080)
    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 7360)
    • Script adds exclusion path to Windows Defender

      • NSudoLG.exe (PID: 7392)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7812)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 2696)
      • cmd.exe (PID: 7732)
      • cmd.exe (PID: 7600)
      • cmd.exe (PID: 8088)
      • cmd.exe (PID: 7740)
      • cmd.exe (PID: 8084)
      • cmd.exe (PID: 7612)
      • cmd.exe (PID: 7724)
      • cmd.exe (PID: 7848)
      • cmd.exe (PID: 3688)
      • cmd.exe (PID: 4032)
      • cmd.exe (PID: 7812)
    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1660)
      • cmd.exe (PID: 7032)
      • cmd.exe (PID: 7964)
      • cmd.exe (PID: 7716)
      • cmd.exe (PID: 6552)
    • Windows service management via SC.EXE

      • sc.exe (PID: 7452)
      • sc.exe (PID: 7764)
      • sc.exe (PID: 7656)
      • sc.exe (PID: 7376)
      • sc.exe (PID: 7952)
      • sc.exe (PID: 7676)
      • sc.exe (PID: 7276)
      • sc.exe (PID: 7192)
      • sc.exe (PID: 7900)
      • sc.exe (PID: 6808)
      • sc.exe (PID: 7420)
      • sc.exe (PID: 3400)
      • sc.exe (PID: 8124)
    • Creates or modifies Windows services

      • Unlocker.exe (PID: 7588)
      • Unlocker.exe (PID: 7660)
      • Unlocker.exe (PID: 8120)
      • Unlocker.exe (PID: 7696)
    • Drops a system driver (possible attempt to evade defenses)

      • Unlocker.exe (PID: 7588)
      • Unlocker.exe (PID: 7288)
      • Unlocker.exe (PID: 7660)
      • Unlocker.exe (PID: 8120)
      • Unlocker.exe (PID: 7696)
    • Stops a currently running service

      • sc.exe (PID: 7712)
      • sc.exe (PID: 5808)
      • sc.exe (PID: 7920)
      • sc.exe (PID: 7552)
      • sc.exe (PID: 7832)
    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7812)
    • Starts a Microsoft application from unusual location

      • oSOnryg.exe (PID: 4552)
      • 4eTHv9F.exe (PID: 8036)
    • Reads the Windows owner or organization settings

      • tktVLbc.tmp (PID: 7824)
      • Dg77GEr8dU.tmp (PID: 7852)
    • Checks for external IP

      • svchost.exe (PID: 2200)
      • sFFG7Wg.exe (PID: 1136)
      • GoogleChrome.exe (PID: 4112)
      • GoogleChrome.exe (PID: 6980)
    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 2892)
    • Connects to unusual port

      • MSBuild.exe (PID: 5084)
      • SynapseR86.exe (PID: 3864)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • GoogleChrome.exe (PID: 4112)
      • GoogleChrome.exe (PID: 6980)
    • Searches for installed software

      • A7KX0pa.exe (PID: 2708)
  • INFO

    • Checks supported languages

      • 2025-06-26_3bfc874b96d701bdcc60998028b3c957_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 2040)
      • RoamingTUAGRCHJFIDLJMJ5Z6RPUHIYL0CD4I4P.EXE (PID: 1156)
      • dumer.exe (PID: 5444)
      • A7KX0pa.exe (PID: 2708)
      • launcher.exe (PID: 4084)
      • javaw.exe (PID: 7108)
      • dumer.exe (PID: 5424)
      • extrimloader.exe (PID: 6140)
      • new-installer.exe (PID: 5424)
      • index.exe (PID: 3980)
      • javaw.exe (PID: 4816)
      • LWlH14qk.exe (PID: 2324)
      • 8Ro1yoh0.exe (PID: 3980)
      • bSFmlcIa.exe (PID: 7188)
      • 0370oKis.exe (PID: 7196)
      • nircmd.exe (PID: 7432)
      • chcp.com (PID: 7456)
      • nircmd.exe (PID: 7508)
      • nircmd.exe (PID: 7668)
      • chcp.com (PID: 7692)
      • NSudoLG.exe (PID: 7752)
      • nircmd.exe (PID: 7888)
      • mode.com (PID: 7988)
      • NSudoLG.exe (PID: 7392)
      • chcp.com (PID: 7912)
      • b2d794c6e7.exe (PID: 7732)
      • index.exe (PID: 7604)
      • 8Ro1yoh0.exe (PID: 7172)
      • bSFmlcIa.exe (PID: 4104)
      • 0370oKis.exe (PID: 640)
      • LWlH14qk.exe (PID: 8016)
      • b2d794c6e7.exe (PID: 7524)
      • nircmd.exe (PID: 7380)
      • RoamingWW8HEHXFUNMHLXYZUTYN4XSXXMBEZWAQ.EXE (PID: 8028)
      • d09db9f5c6.exe (PID: 8184)
      • 7z.exe (PID: 7340)
      • Unlocker.exe (PID: 7344)
      • Unlocker.exe (PID: 7588)
      • RoamingGXN1RKXVBZRDCUB4AJWIMTQSP7XSSUIG.EXE (PID: 8060)
      • dbd2803170.exe (PID: 5652)
      • Unlocker.exe (PID: 7660)
      • IObitUnlocker.exe (PID: 7572)
      • dbd2803170.exe (PID: 5824)
      • Unlocker.exe (PID: 8120)
      • ac75769993.exe (PID: 7760)
      • Unlocker.exe (PID: 7696)
      • tktVLbc.exe (PID: 3860)
      • tktVLbc.tmp (PID: 7824)
      • Tu_Inspector32.exe (PID: 4232)
      • Tu_Inspector32.exe (PID: 7020)
      • sFFG7Wg.exe (PID: 1136)
      • svchost015.exe (PID: 1612)
      • MSBuild.exe (PID: 5084)
      • 4eTHv9F.exe (PID: 8036)
      • GoogleChrome.exe (PID: 4112)
      • GoogleChrome.exe (PID: 6980)
      • identity_helper.exe (PID: 1128)
      • dumer.exe (PID: 8304)
      • SynapseR86.exe (PID: 3864)
      • Bw5ZAOe.exe (PID: 9140)
      • Unlocker.exe (PID: 7288)
      • crashpad_handler.exe (PID: 8316)
      • rM14ix6.exe (PID: 3396)
      • Fv6kVbJ.exe (PID: 8860)
      • Fv6kVbJ.exe (PID: 8692)
      • Dg77GEr8dU.exe (PID: 8836)
      • Dg77GEr8dU.tmp (PID: 7852)
      • kI81c4U.exe (PID: 8472)
      • openfilesviewer.exe (PID: 8708)
      • sSO3g36vQPIs.exe (PID: 5724)
      • IObitUnlocker.exe (PID: 1712)
      • XPFix.exe (PID: 9064)
      • Oz63bRwcl7f1P.exe (PID: 7964)
    • The sample compiled with english language support

      • 2025-06-26_3bfc874b96d701bdcc60998028b3c957_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 2040)
      • extrimloader.exe (PID: 6140)
      • index.exe (PID: 3980)
      • 0370oKis.exe (PID: 7196)
      • dumer.exe (PID: 5444)
      • Unlocker.exe (PID: 7588)
      • Unlocker.exe (PID: 7288)
      • Unlocker.exe (PID: 7660)
      • Unlocker.exe (PID: 8120)
      • Unlocker.exe (PID: 7696)
      • tktVLbc.tmp (PID: 7824)
      • Tu_Inspector32.exe (PID: 4232)
      • ac75769993.exe (PID: 7760)
      • Tu_Inspector32.exe (PID: 7020)
      • explorer.exe (PID: 1336)
      • Dg77GEr8dU.tmp (PID: 7852)
      • openfilesviewer.exe (PID: 8708)
    • Reads mouse settings

      • 2025-06-26_3bfc874b96d701bdcc60998028b3c957_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 2040)
      • LWlH14qk.exe (PID: 2324)
      • b2d794c6e7.exe (PID: 7732)
      • LWlH14qk.exe (PID: 8016)
      • b2d794c6e7.exe (PID: 7524)
    • Reads the computer name

      • 2025-06-26_3bfc874b96d701bdcc60998028b3c957_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 2040)
      • RoamingTUAGRCHJFIDLJMJ5Z6RPUHIYL0CD4I4P.EXE (PID: 1156)
      • dumer.exe (PID: 5444)
      • A7KX0pa.exe (PID: 2708)
      • javaw.exe (PID: 7108)
      • extrimloader.exe (PID: 6140)
      • index.exe (PID: 3980)
      • javaw.exe (PID: 4816)
      • 8Ro1yoh0.exe (PID: 3980)
      • LWlH14qk.exe (PID: 2324)
      • 0370oKis.exe (PID: 7196)
      • nircmd.exe (PID: 7508)
      • NSudoLG.exe (PID: 7752)
      • NSudoLG.exe (PID: 7392)
      • index.exe (PID: 7604)
      • b2d794c6e7.exe (PID: 7732)
      • 8Ro1yoh0.exe (PID: 7172)
      • LWlH14qk.exe (PID: 8016)
      • 0370oKis.exe (PID: 640)
      • b2d794c6e7.exe (PID: 7524)
      • 7z.exe (PID: 7340)
      • Unlocker.exe (PID: 7344)
      • Unlocker.exe (PID: 7588)
      • Unlocker.exe (PID: 7288)
      • dbd2803170.exe (PID: 5652)
      • IObitUnlocker.exe (PID: 7572)
      • Unlocker.exe (PID: 7660)
      • dbd2803170.exe (PID: 5824)
      • Unlocker.exe (PID: 8120)
      • Unlocker.exe (PID: 7696)
      • tktVLbc.tmp (PID: 7824)
      • Tu_Inspector32.exe (PID: 4232)
      • Tu_Inspector32.exe (PID: 7020)
      • sFFG7Wg.exe (PID: 1136)
      • MSBuild.exe (PID: 5084)
      • svchost015.exe (PID: 1612)
      • GoogleChrome.exe (PID: 4112)
      • identity_helper.exe (PID: 1128)
      • SynapseR86.exe (PID: 3864)
      • GoogleChrome.exe (PID: 6980)
      • Bw5ZAOe.exe (PID: 9140)
      • Fv6kVbJ.exe (PID: 8860)
      • Dg77GEr8dU.tmp (PID: 7852)
      • openfilesviewer.exe (PID: 8708)
      • XPFix.exe (PID: 9064)
      • IObitUnlocker.exe (PID: 1712)
      • Oz63bRwcl7f1P.exe (PID: 7964)
    • Reads Internet Explorer settings

      • mshta.exe (PID: 3520)
      • mshta.exe (PID: 7660)
      • mshta.exe (PID: 7384)
    • The executable file from the user directory is run by the Powershell process

      • RoamingTUAGRCHJFIDLJMJ5Z6RPUHIYL0CD4I4P.EXE (PID: 1156)
      • RoamingWW8HEHXFUNMHLXYZUTYN4XSXXMBEZWAQ.EXE (PID: 8028)
      • RoamingGXN1RKXVBZRDCUB4AJWIMTQSP7XSSUIG.EXE (PID: 8060)
    • Disables trace logs

      • powershell.exe (PID: 4932)
      • powershell.exe (PID: 8068)
      • powershell.exe (PID: 8052)
    • Checks proxy server information

      • powershell.exe (PID: 4932)
      • dumer.exe (PID: 5444)
      • powershell.exe (PID: 8068)
      • powershell.exe (PID: 8052)
      • sFFG7Wg.exe (PID: 1136)
      • slui.exe (PID: 4540)
      • svchost015.exe (PID: 1612)
      • GoogleChrome.exe (PID: 4112)
      • GoogleChrome.exe (PID: 6980)
      • Fv6kVbJ.exe (PID: 8860)
    • Create files in a temporary directory

      • dumer.exe (PID: 5444)
      • RoamingTUAGRCHJFIDLJMJ5Z6RPUHIYL0CD4I4P.EXE (PID: 1156)
      • javaw.exe (PID: 7108)
      • extrimloader.exe (PID: 6140)
      • javaw.exe (PID: 4816)
      • 0370oKis.exe (PID: 7196)
      • 0370oKis.exe (PID: 640)
      • 7z.exe (PID: 7340)
      • tktVLbc.exe (PID: 3860)
      • tktVLbc.tmp (PID: 7824)
      • Tu_Inspector32.exe (PID: 7020)
      • ac75769993.exe (PID: 7760)
      • SynapseR86.exe (PID: 3864)
      • Dg77GEr8dU.exe (PID: 8836)
      • Dg77GEr8dU.tmp (PID: 7852)
    • Process checks computer location settings

      • RoamingTUAGRCHJFIDLJMJ5Z6RPUHIYL0CD4I4P.EXE (PID: 1156)
      • dumer.exe (PID: 5444)
      • extrimloader.exe (PID: 6140)
      • index.exe (PID: 3980)
      • 0370oKis.exe (PID: 7196)
      • nircmd.exe (PID: 7508)
      • index.exe (PID: 7604)
      • 0370oKis.exe (PID: 640)
      • openfilesviewer.exe (PID: 8708)
    • Reads the machine GUID from the registry

      • A7KX0pa.exe (PID: 2708)
      • javaw.exe (PID: 7108)
      • javaw.exe (PID: 4816)
      • Unlocker.exe (PID: 7344)
      • Unlocker.exe (PID: 7588)
      • Unlocker.exe (PID: 7288)
      • Unlocker.exe (PID: 7660)
      • dbd2803170.exe (PID: 5652)
      • dbd2803170.exe (PID: 5824)
      • Unlocker.exe (PID: 8120)
      • Unlocker.exe (PID: 7696)
      • sFFG7Wg.exe (PID: 1136)
      • MSBuild.exe (PID: 5084)
      • svchost015.exe (PID: 1612)
      • GoogleChrome.exe (PID: 4112)
      • GoogleChrome.exe (PID: 6980)
      • SynapseR86.exe (PID: 3864)
    • Reads the software policy settings

      • A7KX0pa.exe (PID: 2708)
      • dbd2803170.exe (PID: 5652)
      • dbd2803170.exe (PID: 5824)
      • sFFG7Wg.exe (PID: 1136)
      • slui.exe (PID: 4540)
      • svchost015.exe (PID: 1612)
      • GoogleChrome.exe (PID: 4112)
      • GoogleChrome.exe (PID: 6980)
    • Creates files or folders in the user directory

      • dumer.exe (PID: 5444)
      • javaw.exe (PID: 7108)
      • Tu_Inspector32.exe (PID: 7020)
      • sFFG7Wg.exe (PID: 1136)
      • svchost015.exe (PID: 1612)
      • GoogleChrome.exe (PID: 4112)
      • GoogleChrome.exe (PID: 6980)
      • SynapseR86.exe (PID: 3864)
      • crashpad_handler.exe (PID: 8316)
      • Dg77GEr8dU.tmp (PID: 7852)
    • Application launched itself

      • chrome.exe (PID: 2276)
      • chrome.exe (PID: 5060)
      • chrome.exe (PID: 5424)
      • msedge.exe (PID: 3504)
      • chrome.exe (PID: 1564)
      • msedge.exe (PID: 7552)
      • msedge.exe (PID: 8348)
      • msedge.exe (PID: 7300)
      • chrome.exe (PID: 5372)
    • Themida protector has been detected

      • A7KX0pa.exe (PID: 2708)
    • Creates files in the program directory

      • javaw.exe (PID: 7108)
      • javaw.exe (PID: 4816)
      • Tu_Inspector32.exe (PID: 4232)
      • openfilesviewer.exe (PID: 8708)
      • IObitUnlocker.exe (PID: 1712)
    • NirSoft software is detected

      • nircmd.exe (PID: 7508)
      • nircmd.exe (PID: 7432)
      • nircmd.exe (PID: 7888)
      • nircmd.exe (PID: 7668)
      • nircmd.exe (PID: 7380)
    • Changes the display of characters in the console

      • cmd.exe (PID: 7356)
      • cmd.exe (PID: 7600)
      • cmd.exe (PID: 7812)
    • Launching a file from a Registry key

      • dumer.exe (PID: 5444)
      • sFFG7Wg.exe (PID: 1136)
    • Starts MODE.COM to configure console settings

      • mode.com (PID: 7988)
    • Checks operating system version

      • cmd.exe (PID: 7812)
    • Manual execution by a user

      • index.exe (PID: 7604)
      • b2d794c6e7.exe (PID: 7524)
      • dbd2803170.exe (PID: 5824)
      • wscript.exe (PID: 5540)
      • GoogleChrome.exe (PID: 6980)
      • OpenWith.exe (PID: 4580)
      • notepad.exe (PID: 8228)
      • notepad.exe (PID: 4444)
      • notepad.exe (PID: 9204)
      • OpenWith.exe (PID: 3520)
      • OpenWith.exe (PID: 4224)
      • OpenWith.exe (PID: 8744)
      • OpenWith.exe (PID: 7132)
      • OpenWith.exe (PID: 8784)
      • OpenWith.exe (PID: 8452)
      • notepad.exe (PID: 8944)
      • OpenWith.exe (PID: 8620)
      • IObitUnlocker.exe (PID: 9076)
      • IObitUnlocker.exe (PID: 1712)
    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7360)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7360)
    • The sample compiled with chinese language support

      • dumer.exe (PID: 5444)
      • Tu_Inspector32.exe (PID: 7020)
    • Reads Environment values

      • identity_helper.exe (PID: 1128)
    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 9204)
      • notepad.exe (PID: 8228)
      • notepad.exe (PID: 4444)
      • notepad.exe (PID: 8944)
    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 3520)
      • OpenWith.exe (PID: 4224)
      • OpenWith.exe (PID: 8744)
      • OpenWith.exe (PID: 4580)
      • OpenWith.exe (PID: 8784)
      • OpenWith.exe (PID: 8452)
      • OpenWith.exe (PID: 7132)
      • OpenWith.exe (PID: 8620)
    • Creates a software uninstall entry

      • Dg77GEr8dU.tmp (PID: 7852)
    • Changes the registry key values via Powershell

      • openfilesviewer.exe (PID: 8708)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(5444) dumer.exe
C231.43.185.30
URLhttp://31.43.185.30/ku9f3ton/index.php
Version5.50
Options
Drop directory321c2a24e4
Drop namedumer.exe
Strings (125)Powershell.exe
bi:
AVAST Software
/Plugins/
------
id:
\0000
wb
Programs
-%lu
.jpg
AVG
r=
dm:
-executionpolicy remotesigned -File "
SOFTWARE\Microsoft\Windows NT\CurrentVersion
\
ProgramData\
Avira
e2
os:
http://
vs:
<c>
2025
ComputerName
og:
00000419
rb
2022
Content-Type: application/x-www-form-urlencoded
shell32.dll
https://
Main
Sophos
Norton
GET
#
S-%lu-
st=s
cmd /C RMDIR /s/q
lv:
5.50
msi
Content-Disposition: form-data; name="data"; filename="
d1
2016
ar:
cred.dll|clip.dll|
rundll32
WinDefender
Content-Type: multipart/form-data; boundary=----
Rem
CurrentBuild
0123456789
&& Exit"
un:
Kaspersky Lab
/ku9f3ton/index.php
Bitdefender
+++
av:
rundll32.exe
random
<d>
Keyboard Layout\Preload
shutdown -s -t 0
DefaultSettings.XResolution
/quiet
--
0000043f
Startup
e1
Doctor Web
2019
GetNativeSystemInfo
VideoID
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
:::
ESET
DefaultSettings.YResolution
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
" && ren
abcdefghijklmnopqrstuvwxyz0123456789-_
cmd
"taskkill /f /im "
00000423
-unicode-
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
cred.dll
360TotalSecurity
"
exe
00000422
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
&&
31.43.185.30
dumer.exe
Comodo
" Content-Type: application/octet-stream
------
?scr=1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
zip
321c2a24e4
dll
/k
&unit=
ps1
" && timeout 1 && del
kernel32.dll
ProductName
%-lu
clip.dll
%USERPROFILE%
\App
SYSTEM\ControlSet001\Services\BasicDisplay\Video
pc:
sd:
POST
Panda Security
e3
|
=

Lumma

(PID) Process(2708) A7KX0pa.exe
C2 (9)ropyi.xyz/zadf
skjgx.xyz/riuw
gewgb.xyz/axgh
baviip.xyz/twiw
equidn.xyz/xapq
spjeo.xyz/axka
firddy.xyz/yhbc
shaeb.xyz/ikxz
trqqe.xyz/xudu
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:06:25 15:40:34+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 633856
InitializedDataSize: 326144
UninitializedDataSize: -
EntryPoint: 0x20577
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
484
Monitored processes
331
Malicious processes
53
Suspicious processes
17

Behavior graph

Click at the process to see the details
start 2025-06-26_3bfc874b96d701bdcc60998028b3c957_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs schtasks.exe no specs powershell.exe conhost.exe no specs roamingtuagrchjfidljmj5z6rpuhiyl0cd4i4p.exe #AMADEY dumer.exe #LUMMA a7kx0pa.exe #LUMMA svchost.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs launcher.exe no specs chrome.exe no specs launcher.exe javaw.exe icacls.exe no specs conhost.exe no specs chrome.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs dumer.exe no specs extrimloader.exe no specs extrimloader.exe #JPHPLOADER new-installer.exe no specs javaw.exe no specs index.exe lwlh14qk.exe no specs cmd.exe no specs conhost.exe no specs 8ro1yoh0.exe bsfmlcia.exe no specs 0370okis.exe cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs nircmd.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs nircmd.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs nircmd.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs b2d794c6e7.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs index.exe no specs schtasks.exe no specs lwlh14qk.exe no specs powershell.exe cmd.exe no specs conhost.exe no specs conhost.exe no specs 8ro1yoh0.exe bsfmlcia.exe no specs 0370okis.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs nircmd.exe no specs b2d794c6e7.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs schtasks.exe no specs roamingww8hehxfunmhlxyzutyn4xsxxmbezwaq.exe no specs powershell.exe conhost.exe no specs d09db9f5c6.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs roaminggxn1rkxvbzrdcub4ajwimtqsp7xssuig.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs timeout.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs #LUMMA dbd2803170.exe iobitunlocker.exe timeout.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs #LUMMA dbd2803170.exe timeout.exe no specs ac75769993.exe unlocker.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs osonryg.exe no specs control.exe control.exe explorer.exe tktvlbc.exe tktvlbc.tmp tu_inspector32.exe #GENERIC tu_inspector32.exe #LCLIPPER sffg7wg.exe #GCLEANER svchost015.exe 4ethv9f.exe no specs conhost.exe no specs synapser86.exe wscript.exe no specs msbuild.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs #LCLIPPER googlechrome.exe rundll32.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs #LCLIPPER googlechrome.exe msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs dumer.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs bw5zaoe.exe no specs chrome.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs msedge.exe no specs openwith.exe no specs rm14ix6.exe no specs msedge.exe no specs openwith.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs openwith.exe no specs chrome.exe no specs crashpad_handler.exe no specs openwith.exe no specs msedge.exe no specs openwith.exe no specs fv6kvbj.exe no specs openwith.exe no specs #STEALC fv6kvbj.exe notepad.exe no specs openwith.exe no specs ki81c4u.exe no specs openwith.exe no specs dg77ger8du.exe dg77ger8du.tmp xpfix.exe no specs openfilesviewer.exe iobitunlocker.exe no specs powershell.exe no specs iobitunlocker.exe chrome.exe no specs sso3g36vqpis.exe no specs conhost.exe no specs chrome.exe no specs oz63brwcl7f1p.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
620reg query "HKLM\System\CurrentControlSet\Services\wscsvc" C:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
620\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
640\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
640"C:\Temper\0370oKis.exe"C:\Temper\0370oKis.exeLWlH14qk.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\temper\0370okis.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
684"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3596,i,7025263897360914438,1823433691475507771,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1128"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4660,i,15844732933448254584,9471244273537737413,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4360 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1128"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5840,i,5439198471082415653,1938315299582841263,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1136"C:\Users\admin\AppData\Local\Temp\10500050101\sFFG7Wg.exe" C:\Users\admin\AppData\Local\Temp\10500050101\sFFG7Wg.exe
dumer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\10500050101\sffg7wg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1156"C:\Users\admin\AppData\RoamingTUAGRCHJFIDLJMJ5Z6RPUHIYL0CD4I4P.EXE" C:\Users\admin\AppData\RoamingTUAGRCHJFIDLJMJ5Z6RPUHIYL0CD4I4P.EXE
powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roamingtuagrchjfidljmj5z6rpuhiyl0cd4i4p.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1156"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x304,0x308,0x30c,0x2fc,0x314,0x7ffc452cf208,0x7ffc452cf214,0x7ffc452cf220C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
100 112
Read events
99 944
Write events
168
Delete events
0

Modification events

(PID) Process:(3520) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3520) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3520) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3520) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3520) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3520) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3520) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4932) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4932) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4932) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
267
Suspicious files
438
Text files
451
Unknown types
58

Dropped files

PID
Process
Filename
Type
1564chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old~RF17b69e.TMP
MD5:
SHA256:
1564chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old
MD5:
SHA256:
1564chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF17b6bd.TMP
MD5:
SHA256:
1564chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old
MD5:
SHA256:
1564chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old~RF17b6cd.TMP
MD5:
SHA256:
1564chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF17b6cd.TMP
MD5:
SHA256:
1564chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\LOG.old~RF17b6cd.TMP
MD5:
SHA256:
1564chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old
MD5:
SHA256:
1564chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF17b6dc.TMP
MD5:
SHA256:
1564chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
704
TCP/UDP connections
406
DNS requests
213
Threats
111

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
4400
RUXIMICS.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
4400
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
4932
powershell.exe
GET
200
185.156.72.2:80
http://185.156.72.2/testmine/random.exe
unknown
unknown
POST
200
20.190.159.131:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
POST
200
40.126.31.71:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
POST
200
40.126.31.131:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4400
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
1268
svchost.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5944
MoUsoCoreWorker.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
4400
RUXIMICS.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4400
RUXIMICS.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.134
  • 40.126.32.74
  • 20.190.160.2
  • 40.126.32.72
  • 20.190.160.132
  • 40.126.32.68
  • 40.126.32.138
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted
equidn.xyz
  • 144.172.115.212
unknown
safebrowsingohttpgateway.googleapis.com
  • 172.217.16.202
  • 142.250.184.234
  • 142.250.186.170
  • 142.250.185.202
  • 142.250.185.170
  • 142.250.185.74
  • 142.250.185.234
  • 142.250.74.202
  • 142.250.181.234
  • 216.58.206.74
  • 142.250.185.138
  • 172.217.18.106
  • 172.217.18.10
  • 142.250.185.106
  • 142.250.184.202
  • 216.58.206.42
whitelisted
clients2.google.com
  • 142.250.185.142
whitelisted

Threats

PID
Process
Class
Message
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
4932
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
4932
powershell.exe
Misc activity
ET INFO Packed Executable Download
4932
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
4932
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
4932
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
5444
dumer.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
5444
dumer.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
5444
dumer.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
5444
dumer.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
Process
Message
A7KX0pa.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
dbd2803170.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
IObitUnlocker.exe
PostAction_Delete
IObitUnlocker.exe
FileCount:46
IObitUnlocker.exe
C:\ProgramData\Microsoft\Windows Defender--------
IObitUnlocker.exe
C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection--------
IObitUnlocker.exe
C:\ProgramData\Microsoft\Windows Security Health--------
IObitUnlocker.exe
C:\ProgramData\Microsoft\Storage Health--------
IObitUnlocker.exe
C:\Program Files\Windows Defender--------
IObitUnlocker.exe
C:\Program Files\Windows Defender Advanced Threat Protection--------